Studio Discloses Unauthorized Access, Potential Customer Data Exposure

Studio announced that it detected unauthorized third-party access to the cloud environment it uses. The confirmed period of unauthorized access is 2026-09-30 to 2026-10-01 Japan time. While the company has not confirmed that data were actually exfiltrated, it says it is responding on the basis that data should be considered obtained. The vulnerability was fixed and the access path closed between 2026-10-13 and 2026-10-14.

The company explained that Studio account information (usernames, email addresses, and hashed passwords), design and CMS content, form submissions, live preview URLs, and authentication information contained in various settings (API keys and tokens for external services, webhook URLs, etc.) may have been exposed. It also stated that even encrypted data may have been exposed because the keys required for decryption were read.

As countermeasures, Studio said it has already rotated authentication credentials and encryption keys used for payments and logins, and that it updated encryption keys on 2026-10-17. It also force-logged out all users at 02:30 on 2026-10-14, and sent feature-specific individual emails to the owners of affected projects. For users of the form feature, the company provided guidance allowing them to choose between a joint report and individual reports to the Personal Information Protection Commission.

The company said it has not confirmed any data tampering or deletion at this time, but that investigations into secondary damage and the precise number of affected records are ongoing. It is conducting a root cause investigation and developing recurrence-prevention measures with external experts. Users are urged to take concrete actions such as changing passwords, reissuing or deleting API keys and live preview URLs, and reviewing access histories for integrated services. Further updates will be published on the company's notices page.